Executive Summary

This week saw CISA publish seven ICS advisories across two releases, headlined by a maximum-severity deserialization vulnerability in PTC Windchill (CVE-2026-4681, CVSS 10.0) enabling remote code execution and a critical hidden-functionality flaw in WAGO managed switches (CVE-2026-3587, CVSS 10.0) granting unauthenticated root access. Schneider Electric continued its heavy advisory cadence with disclosures affecting EcoStruxure Foxboro DCS and the Plant iT/Brewmaxx brewing automation platform, while the Grassroots DICOM imaging library received an unpatched medical device advisory after its maintainer failed to respond to CISA coordination. On the regulatory front, FERC unanimously approved 11 updated CIP reliability standards enabling secure virtualization in bulk power systems, and New York became the first U.S. state to mandate cybersecurity incident reporting for all wastewater facilities. The Iranian cyber campaign continued to escalate, with a second U.S. healthcare provider attacked within weeks of the Stryker wiper incident, even as CISA’s acting director testified that roughly 60 percent of the agency’s workforce remains furloughed.

This report focuses on Cyber-Physical Systems (CPS), Industrial Control Systems (ICS), and critical infrastructure security.

Week of March 20 – March 27, 2026

Critical Alerts & Advisories

CISA published seven ICS advisories across two releases this week—four on March 24 (ICSA-26-083-01 through ICSA-26-083-03 and ICSMA-26-083-01) and three on March 26 (ICSA-26-085-01 through ICSA-26-085-03)—covering products from PTC, WAGO, Schneider Electric, and Pharos Controls, alongside a medical device advisory for the Grassroots DICOM imaging library.

The most severe advisory this week addressed PTC Windchill Product Lifecycle Management (ICSA-26-085-03). CVE-2026-4681, carrying a maximum CVSS v3.1 score of 10.0, stems from deserialization of untrusted data that enables unauthenticated remote code execution. PTC Windchill is widely used in aerospace, defense, and manufacturing for managing product data, engineering change orders, and configuration baselines. A compromised Windchill instance could expose proprietary design data, alter engineering records, or serve as a pivot point into production networks. PTC is actively releasing patches for all supported versions, and CISA recommends isolating Windchill servers behind firewalls and limiting internet exposure while updates are applied.

Equally critical, the WAGO managed switch advisory (ICSA-26-085-01) disclosed CVE-2026-3587, a hidden-functionality vulnerability also scored at CVSS 10.0 that allows an unauthenticated remote attacker to escape the restricted CLI environment and gain root-level access to the underlying Linux operating system. The flaw affects nine hardware models across the WAGO 852 series—including the 852-1812, 852-1813, 852-1816, 852-303, 852-1305, 852-1505, 852-602, 852-603, and 852-1605—all widely deployed in industrial Ethernet environments for segmenting and managing OT network traffic. Root access on a managed switch grants an attacker the ability to manipulate network configurations, intercept or redirect traffic between PLCs and SCADA systems, install persistent backdoors, and effectively undermine network segmentation—the primary defensive boundary in most industrial architectures. WAGO has released firmware updates and recommends that operators unable to patch immediately disable SSH and Telnet access entirely, since these remote management protocols provide the attack vector.

Schneider Electric received two advisories in the March 24 batch. ICSA-26-083-02 addressed a deserialization-of-untrusted-data vulnerability in EcoStruxure Foxboro DCS workstation and server software, scored at CVSS 9.8, that could enable remote code execution. While the Foxboro DCS Core Control Services runtime—including FCPs, FDCs, and FBMs—is not affected, a compromised engineering workstation in a DCS environment provides direct access to process control configuration and tuning parameters. ICSA-26-083-03 covered Schneider Electric’s Plant iT/Brewmaxx platform (versions 9.60 and above), disclosing four Redis-related vulnerabilities (CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819) that could lead to privilege escalation and remote code execution through crafted Lua scripts, integer overflows, and code injection. Plant iT/Brewmaxx is used in food and beverage manufacturing—particularly brewing—for batch control and production management, and Schneider has released Patch ProLeiT-2025-001 with guidance to disable Redis eval commands after installation.

The Pharos Controls Mosaic Show Controller advisory (ICSA-26-083-01) disclosed a missing-authentication-for-critical-function vulnerability in firmware version 2.15.3 that allows unauthenticated attackers to bypass authentication and execute arbitrary commands with root privileges. While show controllers may seem peripheral to critical infrastructure, Mosaic systems manage lighting and environmental controls in venues, data centers, and smart buildings—environments where unauthorized command execution could affect life safety systems. Pharos Controls has released firmware version 2.16 as a fix.

Automotive CPS Security

The EV charging infrastructure vulnerability landscape continued to develop this week, though no new coordinated disclosure advisories were published. The CTEK Chargeportal (ICSA-26-078-06, CVSS 9.4), disclosed the prior week, remains notable as CTEK has confirmed it will sunset the product entirely in April 2026. Operators still running CTEK Chargeportal should plan immediate migration, as no further security updates will be provided after the platform’s end of life. The cumulative coordinated disclosure campaign, which has now reached at least eleven vendors across seven countries, continues to underscore a systemic weakness in the EV charging ecosystem’s implementation of the OCPP (Open Charge Point Protocol) standard—specifically, missing authentication on WebSocket endpoints, predictable session identifiers, and insufficiently protected credentials.

Separately, Palo Alto Networks’ Unit 42 research on ICONICS SCADA vulnerabilities (CVE-2025-0921, CVSS 6.5) received continued attention this week. The vulnerability in the ICONICS Suite allows attackers to exploit privileged file system operations to corrupt critical Windows binaries, causing boot failures that trap affected systems in endless repair loops. ICONICS Suite is deployed in hundreds of thousands of installations across more than 100 countries, spanning automotive manufacturing, energy, and building automation sectors. Public internet scans have identified several dozen vulnerable ICONICS servers that remain directly accessible, and researchers emphasized that versions 10.97.2 and 10.97.3 (and possibly earlier) are affected.

The broader automotive cybersecurity landscape remained shaped by the findings from Pwn2Own Automotive 2026 in January, where researchers earned over $1 million for 76 zero-day vulnerabilities across in-vehicle infotainment systems (Tesla, Sony, Alpine), EV chargers, and car operating systems. VicOne’s ongoing analysis of aftermarket peripheral vulnerabilities—five zero-days in CarlinKit and 70mai devices affecting an estimated 85,000 exposed units worldwide—continued to highlight a category of risk that traditional automotive cybersecurity programs have not adequately addressed.

Medical Device CPS Security

The Iranian cyber campaign’s impact on the medical device sector escalated sharply this week. The Foundation for Defense of Democracies (FDD) reported on March 27 that a second U.S. healthcare provider was attacked by an Iran-linked ransomware group in late February, with its systems encrypted in under three hours—just weeks before the Handala wiper attack on Stryker on March 11. The FDD analysis noted that CISA, the agency responsible for defending against these attacks, is operating with roughly 60 percent of its workforce furloughed, and that proactive activities such as vulnerability scanning, security assessments, and stakeholder engagement have been “scaled back or paused.”

Stryker continued system restoration efforts, with TechCrunch reporting on March 17 that the company was rebuilding after Handala wiped over 200,000 devices by exploiting the company’s Microsoft Intune endpoint management platform. While Stryker maintained that no patient-related services or connected medical products were directly affected, the attack disrupted order processing, manufacturing, and global shipping operations. Maryland’s emergency medical services reported that Stryker’s LifeNet electrocardiogram transmission system was “non-functional in most parts of the state” during the incident, though the system itself was not compromised.

CISA published two medical device advisories this week. ICSMA-26-083-01 addressed CVE-2026-3650 in Grassroots DICOM (GDCM) version 3.2.2, a memory leak vulnerability triggered by parsing malformed DICOM files with non-standard VR types that causes resource depletion and denial of service. GDCM underpins PACS servers and diagnostic imaging workstations across hospitals and research institutions, and a successful exploit could crash an entire hospital’s imaging archive or freeze diagnostic workstations during critical reads. Troublingly, the GDCM maintainer has not responded to CISA’s coordination requests, leaving no official patch available—CISA recommends defensive measures including network segmentation and input validation as interim mitigations.

The updated WHILL wheelchair advisory (ICSMA-25-364-01, Update A, March 24) continued to draw attention for its unusual physical safety implications. CVE-2025-14346 (CVSS 9.8) allows an attacker within Bluetooth range to pair with WHILL Model C2 Electric Wheelchairs and Model F Power Chairs without authentication, issue movement commands, override speed restrictions, and manipulate configuration profiles. QED Secure Solutions researchers demonstrated full physical control of the wheelchair using a keyboard and game controller, operating the device at speeds exceeding intended parameters after disabling integrated safety features. WHILL has released firmware updates that disable the BLE interface after installation.

Water & Wastewater Sector

New York became the first U.S. state to implement mandatory cybersecurity incident reporting for wastewater facilities, with the new regulations taking effect on March 26, 2026. Under the adopted amendments to 6 NYCRR Parts 616, 650, and 750, all State Pollutant Discharge Elimination System (SPDES) permittees—regardless of whether they are publicly or privately owned, and regardless of size—must report cybersecurity incidents orally to their Regional Water Engineer within 24 hours, followed by a written report within 30 days. A cybersecurity incident is broadly defined as any event that adversely impacts normal operations, has a reasonable likelihood of harming operations, compromises confidentiality or integrity, or delays compliance with SPDES permit provisions. The New York State Register published the Notice of Adoption on March 11, 2026. This regulatory milestone establishes a template that other states may follow, and it arrives at a moment when the water sector faces elevated threat levels from Iranian-aligned actors continuing to target Unitronics PLCs and internet-exposed HMIs in U.S. water and wastewater systems.

The EPA also reissued its alert in early March encouraging water system operators to strengthen cybersecurity posture in light of Middle East-related threats, specifically noting that Iranian government-affiliated cyber actors have previously exploited internet-exposed OT devices at U.S. water utilities, in some cases forcing temporary reversion to manual operations.

Energy & Power Grid

FERC unanimously approved a sweeping package of reliability and cybersecurity measures on March 20. The centerpiece was 11 updated Critical Infrastructure Protection (CIP) Reliability Standards that enable the secure use of virtualization technologies in bulk power system environments—a recognition that cloud and virtual machine workloads are increasingly present in utility control centers and must be governed by explicit security requirements. The revised standards manage access points and aim to reduce the attack surface in virtualized OT configurations, addressing a gap that has existed since utilities began adopting server virtualization without corresponding CIP Standard coverage.

FERC also approved modifications to CIP-003-11, improving baseline cybersecurity requirements for low-impact bulk electric system (BES) Cyber Systems. The updated standard introduces password protocols for remote users and mandates intrusion detection capabilities for these systems, which include smaller substations, generating facilities, and control centers that previously had minimal cybersecurity requirements under the tiered CIP approach. A companion final rule on Supply Chain Risk Management addressed vendor and third-party risks in the electric grid supply chain, directing NERC to incorporate supply chain protections into new or modified reliability standards.

These regulatory actions arrive as the U.S. energy grid faces converging pressures: aging infrastructure, surging demand from data centers and AI workloads, growing complexity from renewable energy integration, and persistent nation-state threats. Russian threat actors recently gained widespread access to Poland’s solar and wind infrastructure, bricking automation devices without causing power flow disruptions—a probe that demonstrated the capability to escalate to destructive outcomes. The Waterfall Security 2026 Threat Report found that while OT attacks with physical consequences dropped 25 percent in 2025, nation-state and hacktivist attacks nearly doubled, suggesting adversaries are shifting from opportunistic ransomware toward strategic pre-positioning in energy infrastructure.

Manufacturing & Industrial

Manufacturing remained the most targeted industrial sector for ransomware, with attacks rising 56 percent from 937 incidents in 2024 to 1,466 in 2025, while average ransom demands more than doubled from $523,000 to $1.16 million. The Waterfall 2026 Threat Report documented 57 OT attacks with physical consequences worldwide during 2025—a decrease from prior years—but cautioned that this apparent improvement masks a deeper shift as nation-state actors move from disruptive ransomware toward persistent access and pre-positioning in industrial environments.

The PTC Windchill advisory (CVE-2026-4681, CVSS 10.0) has direct implications for manufacturing environments, as Windchill is the product lifecycle management backbone for many aerospace, defense, and discrete manufacturing companies. A compromised PLM system could allow attackers to alter bill-of-materials data, inject malicious design changes, or exfiltrate proprietary engineering data—all with potential downstream effects on physical products and supply chains.

The Schneider Electric Plant iT/Brewmaxx advisory is particularly relevant for food and beverage manufacturing, where the platform manages batch control, recipe execution, and production data. The Redis vulnerabilities enabling remote code execution through crafted Lua scripts represent a pathway from IT-accessible components into the production control layer, underscoring the continuing challenge of IT/OT convergence security in manufacturing environments where embedded databases and middleware components create bridging attack surfaces.

More than 22 percent of organizations reported a cybersecurity incident affecting OT systems in the past year, with 40 percent of these incidents causing operational disruption, according to recent industry surveys. Flat network architectures remain common in manufacturing plants, and the WAGO managed switch vulnerability (CVE-2026-3587) is especially dangerous in these environments—a compromised industrial switch undermines the very network segmentation that defenders rely on to contain lateral movement between IT and OT zones.

Threat Intelligence Highlights

The Iranian cyber campaign entered its fourth week following Operation Epic Fury, and Unit 42’s updated threat brief (March 26) continued to track an increased risk of wiper attacks targeting U.S. organizations. The MOIS-directed Handala group, formally attributed by the U.S. Justice Department the prior week, remains operationally active despite FBI domain seizures. The state-aligned FAD Team claimed unauthorized access to multiple SCADA/PLC systems in Israel and neighboring countries, while CyberAv3ngers—the IRGC-linked group previously sanctioned for Unitronics PLC attacks on U.S. water utilities—continues to represent the highest-priority state-directed threat to water and energy infrastructure.

The Foundation for Defense of Democracies published a detailed analysis on March 27 warning that Iranian cyber operations are exploiting the convergence of reduced U.S. defensive capacity and active military conflict. CISA’s acting director testified on March 25 that roughly 60 percent of the agency’s workforce was furloughed, and that proactive activities reducing systemic risk—including the kind of early warning systems that previously disrupted attacks like the 2014 Boston Children’s Hospital DDoS—have been scaled back or paused. More than 60 Iranian-aligned cyber groups are now conducting operations against U.S. and allied critical infrastructure, deploying denial-of-service attacks, reconnaissance against industrial systems, destructive wiper malware, and credential-harvesting campaigns.

Iran itself has been under near-complete internet blackout since early March, with connectivity at 1–4 percent of normal capacity. While this degraded connectivity likely hinders coordination of sophisticated state-directed operations, the distributed nature of the hacktivist ecosystem—with groups operating from outside Iran—means the tempo of less sophisticated but still disruptive attacks continues.

Defensive Recommendations

Organizations managing CPS and ICS environments should prioritize the following actions this week:

Patch immediately: PTC Windchill (CVE-2026-4681, CVSS 10.0) and WAGO managed switches (CVE-2026-3587, CVSS 10.0) both warrant emergency patching. For WAGO switches that cannot be updated immediately, disable SSH and Telnet access to eliminate the attack vector. Schneider Electric EcoStruxure Foxboro DCS workstations (CVSS 9.8) and Plant iT/Brewmaxx installations should apply available patches and disable Redis eval commands.

Medical imaging environments: Audit for Grassroots DICOM (GDCM) version 3.2.2 in PACS servers and imaging workstations. With no vendor patch available, implement network segmentation to isolate DICOM processing systems and validate input files before processing.

EV charging operators: Operators still running CTEK Chargeportal must plan immediate migration before the April 2026 end-of-life. Audit OCPP WebSocket endpoints across all charging management platforms for authentication gaps.

Wheelchair and mobility device manufacturers: WHILL Model C2 and Model F operators should apply the BLE-disabling firmware update (HMI v2.25) to prevent unauthenticated Bluetooth pairing and remote control.

Water and wastewater utilities: New York SPDES permittees must now comply with 24-hour cybersecurity incident reporting. All U.S. water utilities should review EPA and CISA guidance on hardening internet-exposed OT and HMI systems, particularly Unitronics PLCs.

Energy sector operators: Review FERC’s newly approved CIP virtualization standards and CIP-003-11 updates to assess compliance timelines. Audit low-impact BES Cyber Systems for password hygiene and intrusion detection capabilities.

Iranian threat preparedness: Monitor Unit 42 and CISA alerts for indicators of compromise associated with Handala, CyberAv3ngers, and FAD Team. Ensure Microsoft Intune and other endpoint management platforms have hardened administrative access—the Stryker attack demonstrated how compromised Intune dashboards enable mass device wiping without traditional malware.

Sources Referenced

CISA ICS Advisories:

Threat Intelligence & Analysis:

Vendor Research & Vulnerability Disclosure:

Regulatory & Government:

Industry Reports: